lordceaser-baileys@1.0.21
LordCeaser Baileys 1.0.21 - FINAL FIX 8.2MB WAProto + path fix
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no install-time behavior or observed exfiltration, but its runtime thumbnail implementation contains a concrete shell-injection vulnerability. This warrants a warning rather than a malicious-package block.
Static reason
No blocking static signals were detected.
Trigger
Application code passes an attacker-influenced video file path to the media send API without jpegThumbnail.
Impact
Arbitrary commands may run with the host application's privileges.
Mechanism
Shell command injection through an unquoted ffmpeg input path.
AI rationale
The package has no install-time behavior or observed exfiltration, but its runtime thumbnail implementation contains a concrete shell-injection vulnerability. This warrants a warning rather than a malicious-package block.
Evidence
lib/Utils/messages.jslib/Utils/messages-media.js
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The video thumbnail helper interpolates a path into a shell command and runs it with exec.
- Video messages automatically request thumbnail generation when no thumbnail is supplied; media inputs can be caller-provided file paths.
Evidence against
- package.json has no lifecycle scripts.
- The observed network code supports WhatsApp messaging and media operations; no credential exfiltration or persistence path was found.
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggedlib/Defaults/baileys-version.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/Defaults/baileys-version.jsonView on unpkglib/Utils/messages-media.jsView file
89/** Extracts video thumb using FFMPEG */
const extractVideoThumb = async (path, destPath, time, size) => new Promise((resolve, reject) => {
const cmd = `ffmpeg -ss ${time} -i ${path} -y -vf scale=${size.width}:-1 -vframes 1 -f image2 ${destPath}`;
(0, child_process_1.exec)(cmd, (err) => {
Medium
Ai Review Evidence
The video thumbnail helper interpolates a path into a shell command and runs it with exec.
lib/Utils/messages-media.jsView on unpkg · L89273const getStream = async (item, opts) => {
if (Buffer.isBuffer(item)) {
return { stream: (0, exports.toReadable)(item), type: 'buffer' };
}
if ('stream' in item) {
return { stream: item.stream, type: 'readable' };
}
if (item.url.toString().startsWith('http://') || item.url.toString().startsWith('https://')) {
return { stream: await (0, exports.getHttpStream)(item.url, opts), type: 'remote' };
}
return { stream: (0, fs_1.createReadStream)(item.url), type: 'file' };
};
Findings
1 High4 Medium3 Low
HighSemantic Analysis Limitedlib/Defaults/baileys-version.json
MediumNetwork
MediumAi Review Evidencelib/Utils/messages-media.js
MediumAi Review Evidencelib/Utils/messages.js
MediumAi Review Evidencelib/Utils/messages-media.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to lordceaser-baileys@1.0.21.
See all versions of lordceaser-baileys for other recorded verdicts.
- Review the evidence and your use of lordceaser-baileys@1.0.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.